Security Quiz

1. Have you conducted a penetration test in the past six months?


No, we have never had a penetration test


Yes, we conducted a test using internal personnel within the past six months


Yes, we brought in a third party to assess our network


Yes, we conduct a pen test every quarter (using internal and external testers)

2. Have you baselined the traffic on your network?


No, we do not monitor our network traffic


Yes, we have used tools that monitor our network, but no one watches it
on a daily basis


Yes, we have the tools and staff monitor traffic on a periodic basis


Yes, we have trained staff who know normal vs. unusual traffic on our network
and monitor it regularly, both internally and externally

3. Do you have an incidence response procedure?


No, we do not have an incidence response procedure


Yes, we have it, but we have never tested it


Yes, we have it, and have tested it


Yes, we have it, test it regularly and tweak it regularly

4. Do you have a security awareness program that reaches through your
entire organization?


No, we do not have a security awareness program


Yes, but it is limited to e-mail


Yes, we have e-mails and a Web site


Yes, we have a multifaceted security-awareness program that uses various
media, including the Web, e-mail, print, in-person classes and messages from
our executive team

5. Do you turn off unnecessary services on your servers?


No, we leave all services on after a default operating system install (in
case someone needs one)


No, but we have host-based intrusion detection


No, but we block access to these services inbound with our firewall


Yes, we turn off any service that we do not use with our security postinstall
checklist

6. Do you know what your network looks like?


No, we don't have time to diagram our network


We have a network diagram, but it's a year old


We manually update our diagram every six months


We have a proactive tool that keeps our network diagram up to date automatically

7. Are your patches up to date (operating system and antivirus signatures)?


No, we don't keep either up to date


We update our antivirus signatures regularly


We update our operating system patches regularly


We keep both antivirus and operating system patches up to date automatically

8. Do you do trend analysis on attacks that have occurred to better understand
how to prevent future attacks?


How do you know if you have had a security incident?


No, we don't track security incidents separately from other IT requests


Yes, we track security incidents, but we don't do trend analysis


Yes, we do trend our incidents and update our strategic plan around them

9. Have you conducted an information security risk assessment of your
entire organization within the past 12 months?


Risk assessment? What's that?


No, but we do a penetration test annually


Sort of; we do an IT risk assessment every year


Yes, we do an enterprise risk assessment across the entire enterprise
annually

10. Do you have tools (automated or contractual) to help you secure remote
employees and external partners?


No, we do not require our remote employees or external partners to have
security


Yes, we make external and internal partners sign a contract with security
language imbedded in it


Yes, we have anyone connecting to our network have a minimum level of security
before they connect


Yes, we have anyone connecting to our network have a minimum level of security before they connect, and we audit them to verify their security

11. Does your organization have a disaster recovery plan?


No, but we do backups every day


No, but we do backups and test restores of our tapes


Yes, we have a disaster recovery plan on paper, but we have never tested
it


Yes, we have a disaster recovery plan and it's tested regularly

12. Do you have dedicated security personnel monitoring the events on
your network?


Gee, who is monitoring our network?


No, but we have an intrusion-detection dystem online


Yes, we have a group that monitors logs as just one of its regular duties
during regular business hours


Yes, we have a dedicated staff that monitors activity and is alerted during
off business hours